From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Thu, 10 May 2018 15:17:38 +0000 (+0900)
Subject: units: set RestrictNamespaces=yes to networkd and resolved
X-Git-Tag: v239~278
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=46657f637cc7875c9afbab5f138b59e1fb1c7e3c;p=thirdparty%2Fsystemd.git

units: set RestrictNamespaces=yes to networkd and resolved

Closes #8949.
---

diff --git a/units/systemd-networkd.service.in b/units/systemd-networkd.service.in
index 63ee7354151..d05b3347220 100644
--- a/units/systemd-networkd.service.in
+++ b/units/systemd-networkd.service.in
@@ -33,6 +33,7 @@ ProtectControlGroups=yes
 ProtectKernelModules=yes
 MemoryDenyWriteExecute=yes
 RestrictRealtime=yes
+RestrictNamespaces=yes
 RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 AF_PACKET
 SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap
 SystemCallArchitectures=native
diff --git a/units/systemd-resolved.service.in b/units/systemd-resolved.service.in
index c4c7f1feef9..a939f7259cd 100644
--- a/units/systemd-resolved.service.in
+++ b/units/systemd-resolved.service.in
@@ -37,6 +37,7 @@ ProtectKernelTunables=yes
 ProtectKernelModules=yes
 MemoryDenyWriteExecute=yes
 RestrictRealtime=yes
+RestrictNamespaces=yes
 RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
 SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap
 SystemCallArchitectures=native